From: Dean Luick Date: Thu, 28 Jul 2016 19:21:14 +0000 (-0400) Subject: IB/hfi1: Validate SDMA user request index X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=4fa0d22c9a08f32df4d2f7683b1efe21d1a905ac;p=linux-beck.git IB/hfi1: Validate SDMA user request index Reviewed-by: Ira Weiny Signed-off-by: Dean Luick Signed-off-by: Doug Ledford --- diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c index 6b8d1e8b6286..0a0281ae35f1 100644 --- a/drivers/infiniband/hw/hfi1/user_sdma.c +++ b/drivers/infiniband/hw/hfi1/user_sdma.c @@ -552,6 +552,14 @@ int hfi1_user_sdma_process_request(struct file *fp, struct iovec *iovec, trace_hfi1_sdma_user_reqinfo(dd, uctxt->ctxt, fd->subctxt, (u16 *)&info); + + if (info.comp_idx >= hfi1_sdma_comp_ring_size) { + hfi1_cdbg(SDMA, + "[%u:%u:%u:%u] Invalid comp index", + dd->unit, uctxt->ctxt, fd->subctxt, info.comp_idx); + return -EINVAL; + } + if (cq->comps[info.comp_idx].status == QUEUED || test_bit(SDMA_REQ_IN_USE, &pq->reqs[info.comp_idx].flags)) { hfi1_cdbg(SDMA, "[%u:%u:%u] Entry %u is in QUEUED state",